Vibe Coding In The Enterprise: Balancing Speed With Security

Vibe coding, the practice of building software by describing what you want to an AI tool in plain language, has moved from a developer in-joke to a boardroom topic in less than two years. It promises faster prototypes, lower development costs and a way for people without technical training to build the tools they need.

Adoption has been rapid on both sides of the business. 84% of developers in Stack Overflow's 2025 Developer Survey now use or plan to use AI tools in their work, and Gartner expects 75% of enterprise software engineers to use AI code assistants by 2028, up from fewer than 10% in early 2023. Outside engineering, Klarna CEO Sebastian Siemiatkowski, who has never worked as a programmer, has said he can now vibe code a prototype in about 20 minutes using Cursor, work that once took his team weeks.

In many ways, vibe coding is doing for software what desktop publishing did for print in the 1980s, when anyone with a personal computer could produce a newsletter without a typesetter. The quality of what got produced varied enormously, and the same is proving true of AI-built applications.

For business leaders, that makes vibe coding an opportunity worth taking seriously, along with risks that need to be managed from the start.

Where Vibe Coding Delivers Value

The strongest case for vibe coding is in the early stages of a product or process. Teams can test an idea with real users within days, and product managers can hand engineers a working example instead of a long requirements document, which reduces misunderstandings and shortens development cycles.

Internal tools are another natural fit. Dashboards, request forms, reporting tools and trackers used by small teams are well suited to AI-built software, because they carry limited risk if something goes wrong.

The commercial momentum behind these platforms reflects that demand. Lovable, one of the most widely used vibe coding tools, reached $50 million in annual recurring revenue within six months of launching its app builder, a pace very few software companies have matched.

The Security Risks Behind AI-Generated Code

The challenge with AI-built applications is that problems are rarely visible on the surface. An app can look complete and work as expected in a demo while carrying vulnerabilities that only become apparent once it is exposed to real users and real data.

Research from application security firm Veracode shows the scale of the issue. After testing more than 100 large language models on 80 coding tasks, the company found that 45% of AI-generated code samples contained security vulnerabilities, and the models failed to defend against cross-site scripting in 86% of relevant cases.

The most common issues in AI-built business applications include:

• Exposed credentials: API keys and passwords placed in front-end code, where anyone can read them.
• Missing access controls: Pages or endpoints that return customer data without verifying who is requesting it.
• Unvalidated inputs: Forms that accept any input, leaving the application open to injection attacks.

Why Productivity Gains Can Be Overstated

Speed is the main reason companies adopt vibe coding, yet the evidence suggests the gains are less consistent than they appear. In a randomised controlled trial by the research nonprofit METR, 16 experienced open-source developers expected AI tools to make them 24% faster, but on codebases they knew well the tools actually made them 19% slower, even though the developers estimated afterwards that they had been about 20% faster.

Developer sentiment reflects this. In Stack Overflow's 2025 survey, 46% of developers said they distrust the accuracy of AI output, and 66% named AI solutions that are almost right, but not quite, as their biggest frustration.

There is also a cost dimension that is easy to overlook. Gartner predicts that AI coding costs will exceed the average developer's salary by 2028 as token consumption rises, particularly in organisations that do not govern how these tools are used.

Real-World Lessons From Early Adopters

The most widely reported cautionary example came in July 2025, when Replit's AI agent deleted the live production database of SaaStr founder Jason Lemkin during a declared code freeze, erasing records for more than 1,200 executives. Lemkin was able to recover the data, and Replit introduced new safeguards, including automatic separation of development and production databases. The incident showed how much access AI tools can have once an application is running in production.

Klarna offers a more constructive model. Its CEO uses AI to build prototypes that clarify an idea before engineers become involved, and the production build remains with the engineering team. The prototype serves as a communication tool, while the final product still goes through proper development, testing and review.

Building A Governance Framework For Vibe Coding

To capture the benefits of vibe coding while managing its risks, companies need a clear policy on where AI-built software can be used and when it requires engineering review. A practical framework includes:

• An inventory of existing apps: Many organisations already use AI-built tools that IT is unaware of, and identifying them, along with the data they access, is the first step.
• Clear thresholds for engineering review: Any application that handles customer or payment data, connects to core systems such as a CRM or ERP, or serves a large user base should be reviewed and, where needed, rebuilt by experienced developers.
• Approved tools and data rules: Limiting teams to a small number of approved platforms and prohibiting sensitive data in prompts reduces exposure.
• Security testing before release: Any application shared outside the company should pass a security review first.

These measures fit naturally within a broader AI strategy, such as a structured 90-day AI roadmap, and help ensure that experimentation does not create long-term technical or security debt.

The Road Ahead

When desktop publishing arrived in the 1980s, businesses began producing their own newsletters, flyers and reports, and professional designers increasingly concentrated on the work that carried a company's brand. Vibe coding is likely to follow a similar path, with business teams building more of their own everyday tools while engineering teams focus on the systems that hold customer data, process payments, and keep operations running.

Klarna's approach shows how the two can work together, with AI-built prototypes shaping ideas quickly and experienced developers turning the strongest of them into reliable products. Companies that set clear rules on where AI-built software belongs, and when it needs engineering review, will be in a much better position to capture the speed of vibe coding without inheriting the security and maintenance problems that come with unchecked code.

For businesses whose AI-built applications are starting to handle real users or sensitive data, this is a good moment to review them. TechEssentia works with companies to assess these applications, keep what already works and turn promising prototypes into secure, scalable software.